Table of Contents
Privacy Policy
Sector-7 is committed to protecting the privacy and confidentiality of all individuals who interact with our platform. This Privacy Policy details how we collect, use, store, and share information, and the rights and responsibilities of users under various global regulations including GDPR, CCPA, and other applicable data protection frameworks.
1. Categories of Information Collected
1.1 Voluntary Information
- Email communications, including attachments and metadata.
- Whistleblower reports, including narrative content, attached evidence, and file metadata.
- Personal identifiers provided voluntarily (e.g., names, contact information, organizational affiliation).
- Optional survey or feedback forms for platform improvement.
1.2 Automatically Collected Technical Information
- IP addresses (transiently stored for abuse prevention).
- Browser/OS type and version for compatibility and troubleshooting.
- Access timestamps, session durations, and page visits.
- Visit status codes, error logs, and latency metrics for performance monitoring.
- Geographical region derived from IP routing information for security analytics.
- Behavioral telemetry such as file upload activity and navigation patterns.
1.3 Highly Confidential or Classified Material
- Material marked confidential or classified is isolated in a restricted enclave.
- Sector-7 does not verify provenance or classification, and is not liable for hosting voluntarily submitted content.
- Users must ensure they are legally entitled to transmit such material.
2. Use of Collected Information
- To respond to inquiries or whistleblower submissions.
- System health monitoring, performance optimization, and abuse detection.
- Security incident investigation and mitigation.
- Legal compliance in applicable jurisdictions.
- Aggregate analytics for platform improvement without revealing personal data.
3. Security Measures
- AES-256-GCM encryption at rest, TLS 1.3 for data in transit.
- Multi-factor authentication enforced for all administrative accounts.
- Regular penetration testing, internal audits, and vulnerability scanning.
- Physical access restricted to authorized personnel with logging.
- Secure deletion procedures in compliance with NIST 800-88 standards.
- Regular review of encryption protocols and security configurations.
4. Data Retention Schedule
| Data Type | Retention Period | Notes |
|---|---|---|
| Technical logs (IP, status codes, latency) | 90 days | Aggregate metrics retained beyond for investigations |
| User-submitted reports | Until resolution or legal requirement ends | Confidential material may require extended retention |
| Email communications | 30 days | Deleted unless flagged for ongoing investigation |
| Classified/Highly Sensitive Submissions | As directed by verified legal authority | Secure destruction required upon closure |
| Anonymous feedback forms | 12 months | For analytics and system improvement, stripped of identifiers |
5. User Rights
- Request access to personal data.
- Request correction or deletion.
- Request restrictions on processing or portability of data.
- Opt-out of non-essential telemetry where possible.
- Right to lodge complaints with supervisory authorities.
6. Cookies & Local Storage
Sector-7 does not use tracking cookies for analytics. Only strictly necessary cookies for session management are used. Users may disable local storage via browser settings. Cookies and local storage are never used for tracking user identity without explicit consent.
Terms of Use
By accessing Sector-7, users agree to these Terms of Use. Users must comply with all applicable laws and are prohibited from submitting content they are not legally entitled to share.
1. Account Responsibilities
- Maintain confidentiality of any credentials.
- Ensure content submitted is accurate and lawful.
- Abide by platform rules, moderation guidelines, and security protocols.
- Notify Sector-7 immediately if unauthorized access is suspected.
2. Prohibited Conduct & Content
- CSAM or child exploitation material (immediate report to authorities and termination).
- Malware, viruses, or other harmful code.
- Harassment, threats, illegal activity, or attempts to deanonymize other users.
- Unauthorized penetration testing or security scanning without consent.
- Content that violates intellectual property rights or regulatory restrictions.
3. Enforcement & Termination
Violation of these terms may result in suspension, account deletion, or permanent termination. Sector-7 may report illegal activity to law enforcement. Appeals can be submitted via our support channel and are evaluated by a compliance officer.
4. Export Control & Sanctions Clause
Access or use of Sector-7 is prohibited from sanctioned jurisdictions or where restricted by law. Users must comply with all relevant export control and sanctions regulations, including U.S. and EU laws.
5. Liability & Disclaimers
Sector-7 is not liable for damages arising from user submissions, service interruptions, or third-party actions. Users assume all risks associated with content submission. Use constitutes acceptance of these terms and acknowledgment that Sector-7 operates as an anonymized platform for information sharing only.
Audit Trails, Reporting & Schedules
Sector-7 maintains comprehensive audit trails for security, compliance, and operational integrity. All logs and reports are retained and reviewed systematically.
1. Audit Types & Responsibilities
| Audit Type | Frequency | Responsible Team | Purpose / Scope |
|---|---|---|---|
| Internal Security Audit | Quarterly | Security Operations | Review system configuration, vulnerability mitigation, access control |
| Compliance Audit | Annual | Legal & Compliance | Verify adherence to GDPR, CCPA, ISO27001, SOC2, and internal policies |
| Incident Review | After Each Incident | Incident Response Team | Document root cause, response effectiveness, lessons learned |
| Vulnerability Testing | Monthly | Red Team / Pen Test | Proactively identify weaknesses in infrastructure, applications, and processes |
| Operational Audit | Bi-Annually | Operations Team | Assess workflow efficiency, uptime metrics, and SLA compliance |
2. Audit Logging & Retention
All events are logged with time-stamped entries, user identifiers, action details, and system context. Logs include:
- User authentication events and failed login attempts.
- File uploads, downloads, and deletions.
- Administrative changes to system configuration.
- Security incidents, alerts, and mitigation actions.
Audit logs are retained per category in alignment with the Retention & Deletion Schedule in Annex A4, encrypted at rest and restricted to authorized personnel.
Annexes & Schedules
Annex A1 – Cryptographic Standards Schedule
Sector-7 enforces strict cryptographic standards to ensure confidentiality, integrity, and authenticity of all sensitive data. This includes user submissions, internal logs, backups, and communications.
| Algorithm | Key Length / Strength | Purpose | Usage Notes / Examples |
|---|---|---|---|
| AES-GCM | 256-bit | Data at rest encryption | All user-submitted files, database backups, audit logs |
| TLS 1.3 | N/A | Data in transit encryption | Web API endpoints, email transport, internal RPC channels |
| RSA | 4096-bit | Secure key exchange / Digital signatures | PGP for external submissions, server signing of audit reports |
| ECC (secp521r1) | 521-bit | Asymmetric encryption | Key exchange for TLS sessions, PGP encryption of sensitive files |
| SHA-3-512 | N/A | Integrity / Hashing | Checksums for uploaded reports, backup verification, log integrity |
Example: All uploaded whistleblower reports are AES-256 encrypted at rest and digitally signed with RSA keys to ensure authenticity.
Annex A2 – Telemetry & Logging Schedule
All visitor and system telemetry is captured to maintain operational security, detect abuse, and improve performance.
| Field | Purpose | Lawful Basis | Retention | Opt-Out |
|---|---|---|---|---|
| IP Address | Abuse prevention, rate-limiting | Legitimate Interest | 90 days | Use Tor or VPN |
| Access Timestamp | Audit, troubleshooting | Legitimate Interest | 90 days | Cannot opt-out |
| Latency / Response Time | Performance tuning | Legitimate Interest | Aggregate only | N/A |
| Browser & OS | Compatibility analysis | Legitimate Interest | 90 days | Minimal opt-out via user agent masking |
| Geo-region | Detect anomalies & attacks | Legitimate Interest | 90 days | Use Tor or VPN |
Example: A spike in login attempts from a single IP triggers automated alerts for security staff review.
Annex A3 – Incident Response & Severity Levels
All incidents are classified by severity to determine escalation and response.
| Severity | Response Time | Escalation | Description / Example |
|---|---|---|---|
| Critical | Within 1 hour | Executive & Security Team | Data breach exposing sensitive reports, CSAM detected |
| High | Within 4 hours | Security Team Lead | Attempted intrusion, malware alert, suspicious system changes |
| Medium | Within 24 hours | IT Operations | Service degradation, minor report processing errors |
| Low | Within 48 hours | System Admin | Routine maintenance, configuration corrections |
All incidents are logged in the Incident Management System and assigned a unique reference ID for follow-up and auditing.
Annex A4 – Data Retention & Deletion Schedule
| Data Category | Retention Period | Deletion Procedure |
|---|---|---|
| Technical Logs | 90 days | Secure erase with NIST 800-88 |
| User Reports | Until resolution/legal requirement | Encrypted deletion once closed |
| Email Correspondence | 30 days unless flagged | Encrypted wipe |
| Backups | 180 days | Automatic purge from offline storage |
| Classified Material | Until legal directive | Secure destruction per authority instructions |
Example: When a report is resolved, the file is deleted from storage using cryptographically secure wiping, and a log entry confirms deletion.
Annex A5 – Vulnerability Disclosure Policy
Sector-7 encourages ethical security researchers to submit potential vulnerabilities.
- Email reports to security@sector-7.org with technical details.
- Provide reproducible steps, screenshots, and potential impact.
- Sector-7 acknowledges receipt within 72 hours and responds within 14 days.
- Safe-harbour protection ensures researchers are not prosecuted if compliant with policy.
Annex A6 – Transparency Reporting Policy
Sector-7 publishes transparency reports to maintain accountability and public trust.
| Report Type | Frequency | Contents / Example |
|---|---|---|
| User Submissions Volume | Quarterly | Total number of reports submitted, anonymized |
| Authority Requests | Quarterly | Requests for user data and handling method |
| Security Incidents | Annual | Aggregate statistics, resolution times, and lessons learned |
Example: Quarterly transparency report shows 12,345 reports submitted, with 3 requests for disclosure, all anonymized.
Annex A7 – Data Breach Notification Procedures
Data breaches are classified by severity; notifications comply with GDPR/CCPA timelines.
- Critical breaches: notify authorities within 72 hours.
- Affected users are informed within 72 hours with mitigation guidance.
- Documentation of notification maintained indefinitely for audit purposes.
- All breach responses include root cause analysis, action taken, and follow-up review.
Annex A8 – Legal & Compliance References
| Law / Standard | Scope | Enforcement / Notes |
|---|---|---|
| GDPR | EU personal data | Right to access, delete, portability; annual audits |
| CCPA | California residents | Opt-out, data disclosure requests, annual compliance checks |
| ISO 27001 | Information Security Management | Annual external audits, certified practices |
| NIST 800-88 | Data deletion standards | Applied to all secure deletion procedures |
| SOC2 | Security, Availability, Confidentiality, Privacy, Processing Integrity | Internal quarterly audits and reporting |
Example: GDPR requests are logged, verified, and fulfilled within 30 days using anonymized reporting methods for auditing.
Annex A9 – User Data Anonymization & Pseudonymization
To protect whistleblowers and other users, Sector-7 implements strict anonymization and pseudonymization protocols:
- All user-submitted reports are pseudonymized prior to storage in analytics or reporting pipelines.
- Anonymization techniques include hashing personal identifiers, removing metadata, and using one-way transformations.
- Periodic audits verify that anonymized datasets cannot be reverse-engineered to identify individuals.
| Data Field | Method | Example |
|---|---|---|
| Email Address | SHA-3 Hashing | user@example.com → 3f2a…9b4f |
| IP Address | Truncation & Masking | 192.168.1.100 → 192.168.1.0 |
| Full Name | Pseudonym Code | John Doe → U12345 |
Annex A10 – Employee Access & Role-Based Controls
Sector-7 enforces strict access controls to ensure that only authorized personnel can access sensitive information.
| Role | Access Level | Example Permissions |
|---|---|---|
| Administrator | Full | User management, content deletion, system configuration |
| Security Analyst | Restricted | Incident monitoring, log review, alert management |
| Compliance Officer | Read-only / Audit | Access reports, anonymized data, compliance documentation |
| Support Staff | Minimal | Respond to user inquiries, no access to sensitive files |
MFA is mandatory for all roles with elevated privileges. Logs of access attempts are kept for 180 days and reviewed monthly.
Annex A11 – Incident Simulation & Training Schedule
Sector-7 conducts regular simulations to maintain readiness for potential security incidents:
- Quarterly phishing simulations for staff to ensure recognition and response.
- Annual full-scale data breach drills involving all security and IT staff.
- Monthly tabletop exercises to review potential vulnerabilities and incident response improvements.
| Exercise Type | Frequency | Participants | Objective |
|---|---|---|---|
| Phishing Simulation | Quarterly | All employees | Recognize and report phishing attempts |
| Data Breach Drill | Annual | Security & IT Teams | Test incident response and communication |
| Tabletop Review | Monthly | Incident Response & Compliance | Evaluate response plans and refine procedures |
Annex A12 – Policy Review & Update Schedule
Sector-7 policies are reviewed and updated regularly to comply with evolving legal requirements and best practices:
- Quarterly internal review by Security & Compliance teams.
- Annual external review by independent legal auditors.
- Immediate updates applied if regulatory changes occur or critical incidents arise.
| Policy / Document | Review Frequency | Responsible Team |
|---|---|---|
| Privacy Policy | Quarterly | Compliance Team |
| Terms of Use | Annual or as required | Legal Team |
| Audit & Incident Procedures | Quarterly | Security Operations |
| Data Retention & Deletion | Annual | IT & Compliance |
Definitions
For clarity in these policies, the following terms are defined as follows:
- User: Any individual accessing or submitting content on Sector-7.
- Report: Any information, document, or evidence submitted by a user.
- Personal Data: Information relating to an identified or identifiable individual.
- Sensitive Data: Personal Data that includes confidential or legally protected information.
- Incident: Any event that affects the confidentiality, integrity, or availability of the platform or user data.
- Breach: A confirmed unauthorized access, disclosure, alteration, or destruction of data.
- Third-Party Service: Any external provider supporting the operation of Sector-7.
Version History & Change Log
| Version | Date | Author / Team | Summary of Changes |
|---|---|---|---|
| 1.0 | 2025-01-15 | Legal & Compliance Team | Initial creation of policies including privacy, terms, and annexes. |
| 1.1 | 2025-04-30 | Security Operations | Expanded incident response protocols, added Annex A3 severity levels. |
| 1.2 | 2025-08-20 | Compliance & IT | Updated GDPR & CCPA references, added AI ethics and child protection sections. |
Contact & Escalation Details
For policy, compliance, or security inquiries, users may contact the following:
- General Support: support.sector-7@protonmail.com
- Whistleblower Submission Support: sector-7reports@protonmail.com
- Security & Vulnerability Reporting: security@sector-7.org
- Legal & Compliance Escalation: legal@sector-7.org
Escalation procedures follow the severity levels defined in Annex A3.
User Acknowledgement
By accessing or using Sector-7, all users acknowledge that they have read, understood, and agree to comply with these policies, including all annexes, schedules, and updates. Users agree that failure to comply may result in suspension, termination, or legal action.
Legal Jurisdiction & Dispute Resolution
These policies are governed by the laws of [Your Jurisdiction], except where local mandatory laws apply. Any dispute arising from use of Sector-7 will be resolved through the following mechanisms:
- Negotiation: Parties shall attempt informal resolution within 30 days.
- Arbitration: Disputes not resolved shall be submitted to binding arbitration under [specified rules].
- Court Jurisdiction: If arbitration is unenforceable, parties consent to courts located in [Your Jurisdiction].
Accessibility & Inclusion
Sector-7 is committed to accessibility for all users. Platform design adheres to WCAG 2.1 standards, including screen reader compatibility, keyboard navigation, and text contrast for visually impaired users. Feedback on accessibility issues may be submitted to support.sector-7@protonmail.com.
Risk & Limitation Disclaimers
While Sector-7 implements extensive security and privacy measures, users acknowledge that:
- The platform cannot verify the authenticity or legality of user submissions.
- Third-party services may be subject to downtime or security events beyond Sector-7 control.
- Sector-7 is not liable for indirect, incidental, or consequential damages arising from use or reliance on the platform.
Example Incident Workflows
The following illustrates standard procedures for handling incidents:
| Step | Action | Responsible Party | Timeline |
|---|---|---|---|
| 1 | Incident detected via monitoring system | Security Operations | Immediate |
| 2 | Initial severity assessment | Incident Response Lead | Within 30 mins |
| 3 | Escalate based on Annex A3 severity | Executive & Security Team | Within 1 hour (Critical) |
| 4 | User notification if affected | Compliance & Legal | Within 72 hours |
| 5 | Post-incident review & reporting | Incident Response Team | Within 7 days |
Darknet / Tor Services & Relay Operations
Sector-7 provides access to certain services over the Tor network to maintain user anonymity and secure communications. This section outlines responsibilities, limitations, and operational practices related to our darknet infrastructure.
1. Darknet Hosting & Responsibilities
- Sector-7 hosts services on the Tor network, ensuring anonymity for users submitting sensitive information.
- Types of content hosted include:
- Whistleblower reports, including textual reports, documents, and attached evidence.
- Anonymous communication portals for journalists, legal advisors, and human rights organizations.
- Technical documentation, cybersecurity research, and public transparency materials.
- Encrypted archives of submissions and system logs for audit purposes.
- Illegal content such as CSAM, malware, or pirated material is strictly prohibited and immediately reported or removed.
- Users are responsible for their submissions; Sector-7 provides secure infrastructure but does not endorse user-submitted content.
- All hosted material is encrypted and isolated from public networks, reducing exposure risk.
2. Relay Operations & Responsibilities
Sector-7 operates multiple Tor relay nodes to support network privacy, accessibility, and resilience. Relays facilitate anonymized traffic for all users and contribute to the wider Tor network:
- Relays only pass encrypted traffic and do not inspect or store content.
- Sector-7 does not monitor relay traffic and cannot identify individual users.
- Relays follow strict security standards, including software updates, intrusion detection, and firewall protections.
- Sector-7 is not liable for illegal activity by third parties using these relays.
- Relay nodes are configured to comply with applicable law to the extent required without compromising anonymity.
Relay Security Measures
| Measure | Description | Purpose |
|---|---|---|
| Encrypted Traffic Only | No plaintext logging; all relay traffic encrypted | Preserve confidentiality of network traffic |
| Regular Software Patching | Tor software and OS patched promptly | Protect relays against vulnerabilities |
| DoS & Abuse Mitigation | Rate-limiting, firewall rules, monitoring abnormal patterns | Ensure relay uptime and service integrity |
| Operational Separation | Relays isolated from submission/storage infrastructure | Prevent compromise of sensitive user content |
3. Disclaimer & User Acknowledgment
- By using Sector-7 Tor services or relays, users acknowledge that these are anonymized network conduits and that Sector-7 is not responsible for third-party activity.
- Sector-7 provides darknet access to enhance privacy but does not facilitate illegal content or activity.
- All users must comply with applicable laws; Sector-7 retains the right to report unlawful activity to authorities.
References
Printable / PDF Version
A complete, formatted PDF version of these policies is available for download and offline reference. Users may request the PDF by contacting support.sector-7@protonmail.com or automatically via the platform interface (if available).